CVE-2023-22909

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39...

5.3 MediumFix available

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: Low

Exploit likelihood

0.89%Down 0.2 points since Jan 10, 2023

What each source reports

NVD Score used 5.3

Record: CVE-2023-22909
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

CVE List 5.3

Record: CVE-2023-22909
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

EUVDEUVD-2023-27011 5.3

Record: EUVD-2023-27011
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4wpp-22r3-jr8g 5.3

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39...

Record: GHSA-4wpp-22r3-jr8g
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSV 5.3

Record: CVE-2023-22909
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-22909 5.3

Record: UBUNTU-CVE-2023-22909
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated: 2026-11-02

OSVBIT-mediawiki-2023-22909 No score

Record: BIT-mediawiki-2023-22909
Updated: 2026-11-02

OSVMGASA-2023-0204 No score

Updated mediawiki packages fix security vulnerability

Bundled PapaParse copy in VisualEditor has known ReDos (CVE-2020-36649).

An issue was discovered in MediaWiki before 1.35.9. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data (CVE-2022-47927).

An issue was discovered in MediaWiki before 1.35.9. SpecialMobileHistory allows remote attackers to cause a denial of service because database queries are slow (CVE-2023-22909).

An issue was discovered in MediaWiki before 1.35.9. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context (CVE-2023-22911).

An issue was discovered in MediaWiki before 1.35.10. An auto-block can occur for an untrusted X-Forwarded-For header (CVE-2023-29141).

OATHAuth allows replay attacks when MediaWiki is configured without ObjectCache; Insecure Default Configuration (T330086).

Record: MGASA-2023-0204
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mediawiki` Bitnami	before 1.35.9, 1.36.0 up to 1.38.5, 1.39.0 up to 1.39.1	1.35.91.38.51.39.1
`mediawiki` Mageia:8 From an advisory covering 5 CVEs	before 1.35.10-1.mga8	1.35.10-1.mga8
`mediawiki` Ubuntu:18.04:LTS	All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3	None known
`mediawiki` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less 1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1	None known
`mediawiki` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1	None known
`mediawiki` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1	None known
`mediawiki` Ubuntu:25.10	All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1	None known
`mediawiki` Ubuntu:26.10	All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1	None known
`mediawiki` Ubuntu:26.04:LTS	All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-22909 is a medium vulnerability (CVSS 5.3) in Mediawiki, published January 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in mediawiki 1.35.9.

References

Show 8 moreShow less